Non notée
CVE-2021-20288 An authentication flaw was found in ceph in versions before 14.2.20
Description
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ceph | Versions non publiées |
Références
- bugzilla.redhat.com bugzilla.redhat.com
- FEDORA-2021-e29c1ee892 lists.fedoraproject.org
- FEDORA-2021-e65b9fb52e lists.fedoraproject.org
- FEDORA-2021-168fbed46f lists.fedoraproject.org
- GLSA-202105-39 security.gentoo.org
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3629-1] ceph security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de ceph
Les 10 CVE de ceph →
CVE-2022-3854
A flaw was found in Ceph, relating to the URL processing on RGW backends
6.5
Moyenne
CVE-2022-3650
A privilege escalation flaw was found in Ceph
Non notée
CVE-2021-3979
A key length flaw was found in Red Hat Ceph Storage
Non notée
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any…
Non notée